CVE-2023-1095

What it actually does

NULL pointer dereference in nf_tables_updtable when nf_tables_table_enable fails, causing nft_trans_destroy to call list_del on an uninitialized (all-zero) list head, resulting in kernel crash.

Why it matters to the business

Local denial-of-service that crashes the system and disrupts all services running on affected Linux hosts; low EPSS and no known ransomware use reduce immediate external risk, but the 1326-day-old flaw still requires patching across the ecosystem.

How an attack unfolds

An attacker with local user privileges crafts an nf_tables table update that triggers an error path inside nf_tables_table_enable, causing the subsequent call to nft_trans_destroy to dereference a NULL list head and panic the kernel; no remote or unauthenticated vector exists.

How to fix it

Upgrade the Linux kernel to commit 580077855a40741cf511766129702d97ff02f4d9 or later; rebuild and reboot with the patched kernel; if immediate update is impossible, restrict unprivileged local access to nf_tables via capabilities or seccomp filters.

How to confirm the fix worked

Confirm the running kernel contains commit 580077855a40741cf511766129702d97ff02f4d9 by checking /proc/version or kernel build logs; attempt to reproduce the error path in a test environment and verify no crash occurs.

Typical attack path

1. Obtain local shell access on a vulnerable Linux system
2. Load or interact with the nf_tables netfilter subsystem
3. Issue a table update operation engineered to fail inside nf_tables_table_enable
4. Trigger the error path that calls nft_trans_destroy on an uninitialized transaction object
5. Cause kernel NULL pointer dereference and system crash

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for NULL pointer dereference oops mentioning nf_tables_updtable, nft_trans_destroy, or list_del; correlate with processes that recently performed nftables operations.

• nf_tables_updtable
• nft_trans_destroy
• list_del
• NULL pointer dereference
• general protection fault

What your security team should do

• Apply the referenced kernel commit immediately on all production systems
• Restrict local nf_tables access for non-administrative users until patched
• Monitor kernel logs for nf_tables-related oops or panic entries
• Include the fixed commit in automated kernel update pipelines